Secunia

Steve Kemp has reported multiple vulnerabilities in FTE Text Editor, which potentially can be exploited by malicious, local users to gain escalated privileges on a vulnerable system.

The vulnerabilities are caused due to boundary errors within the vfte utility when handling certain command line arguments and environment variables. These can be exploited to cause buffer overflows by supplying overly long command line arguments or environment variables to the utility.

Successful exploitation may allow execution of arbitrary code with escalated privileges on systems where the utility is installed setuid/setgid.

Solution
Remove setuid and setgid bits from the utility.
Further details available in Customer Area

Provided and/or discovered by
Steve Kemp

Changelog
Further details available in Customer Area

Original Advisory
http://shellcode.org/Advisories/FTE.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area